CVE-2026-80899 erofs: remove fscache backend entirely

What is CVE-2026-80899?

CVE-2026-80899 is a vulnerability in Linux, published on 4 Sep 2026.

Official description

In the Linux kernel, the following vulnerability has been resolved:

erofs: remove fscache backend entirely

EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a local filesystem and has an kernel-defined caching hierarchy which could be inflexible compared to the fanotify pre-content hooks. Therefore, this feature has been deprecated for almost two years.

As EROFS file-backed mounts and fanotify pre-content hooks both upstream for a while and already providing equivalent functionality (erofs-utils has supported fanotify pre-content hooks), let's remove the fscache backend now.

The main application of this feature is Nydus [1], and they plan to move to use fanotify pre-content hooks in the near future too.

I hope this patch can be merged into Linux 7.2, which is also motivated by newly found implementation issues [2][3] that are not worth investigating given the deprecation and limited development resources. The associated fscache/cachefiles cleanup patch will follow separately through the vfs tree (netfs) later: it seems fine since the codebase is isolated by CONFIG_CACHEFILES_ONDEMAND.

[1] https://github.com/dragonflyoss/nydus/blob/v2.1.0/docs/nydus-fscache.md [2] https://github.com/dragonflyoss/nydus/pull/1824 [3] https://lore.kernel.org/r/[email protected]

Which versions are affected by CVE-2026-80899?

How do I fix CVE-2026-80899?

Apply the vendor's patch.

Is CVE-2026-80899 being exploited?

There is no known exploitation of CVE-2026-80899 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-99582, BELL-CVE-2026-80899, DEBIAN-CVE-2026-80899, GHSA-gh58-fmwq-66r3, UBUNTU-CVE-2026-80899.